Because it adds functionality to the normal browser context, MetaMask requires the permission to read and write to any webpage.
However, it still runs somewhat sandboxed, so it is limited to the browser. It can't sniff your network interface, or read a local file. Keylogging is limited to keys entered within the browser.
Even if the plugin itself is not malicious, it could contain a vulnerability that could then be exploited by any page on the internet you visit.
So browser plugins are fairly powerful. Chrome and Mozilla do some checks before adding extensions to their app repositories, but that does not provide guarantees.